Atenção Primária à Saúde Brazil Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 4, 2025, the ransomware group nova listed Atenção Primária à Saúde Brazil on its data-leak site. The listing states that internal files were taken from the organization’s systems and clouds, specifically claiming 100 GB of SQL files containing millions of patient records and more than 50 million record lines. The number of individuals affected has not been confirmed.

The incident involves a health-information system operated under Brazil’s Ministry of Health. Public confirmation or additional technical detail from the organization has not been reported.

Inside the incident

The group’s listing describes exfiltration of SQL files from the systems associated with the domain esusbelacruz.fixtecnologia.com.br. It offers samples to the organization upon contact and states the data volume as 100 GB with more than 50 million record lines. No independent verification of the claimed volume or contents has been published, and the organization has not released a statement on the matter. The exact timing of the intrusion and the method used remain undisclosed.

Inside nova

Nova is a ransomware group that publicly lists victim organizations on a leak site when ransom demands are not met. Its typical activity includes encrypting systems and removing copies of data, then using the leak site to pressure targets. The group’s listing of Atenção Primária à Saúde Brazil constitutes its claim of access; no separate confirmation of the claim has been issued by the victim or by law-enforcement agencies.

Who is Atenção Primária à Saúde Brazil?

Atenção Primária à Saúde Brazil is a system provided by the Ministério da Saúde to support primary-health-care records and related administrative functions. Organizations of this type routinely process patient identifiers, clinical notes, appointment data, and service-delivery information across municipal and state health networks. A breach affecting such a system therefore touches core public-health infrastructure used by millions of Brazilian residents.

The information in question

The listing names internal SQL files as the material removed. The group claims these files contain patient records, but the precise fields or tables have not been independently verified. Organizations in this sector commonly hold names, national identification numbers, dates of birth, addresses, medical histories, and service logs; whether those specific categories are present in the claimed exfiltration is unconfirmed.

What's at stake

Health records can be used for identity fraud, targeted scams, or unauthorized access to other services that rely on the same identifiers. For the health system itself, exposure of operational SQL data may complicate recovery, require extended forensic review, and prompt regulatory scrutiny under Brazil’s data-protection framework. Individuals whose records are involved face ongoing privacy risks whose scope cannot yet be quantified.

Were you affected?

Individuals who receive care through primary-health units served by the system should monitor official statements from the Ministério da Saúde and their local health secretariats. Practical steps include reviewing bank and government-service accounts for unusual activity and changing passwords on any linked portals. Readers may also run a free exposure scan of their email address against known breach data to check for prior appearances of their information in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.